NIS2 applies in Portugal through Decreto-Lei n.º 125/2025, in force since April 2026, and CNCS is the authority. Answer about ten questions to see whether organisations like yours are typically essential, important or out of scope under the directive, then see Portugal’s own rules on registration, incident reporting and fines.
NIS2 in Portugal at a glance
In force since April 2026: Decreto-Lei n.º 125/2025 (Regime Jurídico da Cibersegurança) took effect 120 days after its publication on 4 December 2025, which is 3 April 2026 on a plain count (some advisers give 6 April 2026). Checked 3 November 2026.
| National law | Decreto-Lei n.º 125/2025 (Regime Jurídico da Cibersegurança), published 4 December 2025 and in force since 3 April 2026 (120 days after publication; some sources give 6 April). CNCS’s implementing regulation (Regulamento n.º 756/2026) has applied since 23 June 2026. |
|---|---|
| Authority | CNCS (Centro Nacional de Cibersegurança) is the competent authority and single point of contact. CERT.PT, part of CNCS, is the CSIRT. ANACOM supervises electronic communications and postal services, and GNS supervises trust services. |
| Registration | Entities in scope, including all public bodies, must self-identify on the CNCS electronic platform (MyCiber). Entities already active had 60 days after the platform opened (RJC Art. 8(1)). CNCS’s coordinator was reported (ECO, 24 June 2026) as reading this as 60 working days from the launch on 23 June 2026, which ends around 15 September 2026; counted in calendar days it ended about 22 August 2026. Either way the window has closed, so if you have not registered, do it now. New entities have 30 days from starting activity. |
| Officer and contact point | Essential and important entities also notify a cybersecurity officer and a permanent contact point within 20 working days. The contact point must be available 24/7 during activation periods called by the authority. For entities that were already active, the 20 days run from CNCS’s qualification notice. |
| Incident reporting | Initial notification within 24 hours; an update within 72 hours where necessary; a notice within 24 hours after the impact ends; final report within 30 working days of that notice. Incidents resolved within 2 hours only need the end-of-impact notice. |
| Fines | For very serious breaches (for example the security measures, incident reporting, the cybersecurity officer and the contact point): essential entities up to €10 million or 2% of worldwide annual turnover, whichever is higher, and important entities up to €7 million or 1.4%, whichever is higher. Where the offender is a natural person (for example a sole trader), the cap is €200,000. Serious breaches, which include failing to self-identify or register, are capped at €5 million or 1% (essential) and €3.5 million or 0.7% (important). Public relevant entities have lower caps of up to €4 million (Group A) and €350,000 (Group B). Negligence halves the limits. |
| Key dates | During the first 12 months after entry into force (to about 3 April 2027), an entity can make a reasoned request to the competent authority (CNCS, or ANACOM or GNS in their sectors) not to be fined for very serious or serious breaches, on the ground that it has not yet had an internal process to adapt to the new regime. The duty to adopt the cybersecurity measures (RJC Art. 27(1)-(2), 28 and 29), the annual report (Art. 30), the measures for public relevant entities (Art. 33) and the matching fines take effect 24 months after the CNCS regulation was published, so about 22 June 2028 (DL 125/2025 Art. 10(2)). Self-identification, the cybersecurity officer, the permanent contact point, incident reporting and the management body’s duties already apply. |
| Management | The management body approves and oversees the security measures and ensures regular cybersecurity training. Members can be liable for intentional or grossly negligent acts or omissions. |
Where Portugal differs from the directive
The checker applies the directive’s EU-wide rules (Articles 2 and 3 of Directive (EU) 2022/2555 and the EU SME definition). In Portugal, also check:
- Portugal goes further than the directive. The decree covers the whole public administration: State and regional (Azores, Madeira) services, indirect and local (autonomous) administration, and independent bodies except Banco de Portugal, CMVM and ASF. Only bodies whose remit is developing, maintaining or managing ICT infrastructure, bodies with a particularly high degree of digital integration, and the education-assessment body are essential (RJC Art. 6(1)(d)). For any other public body an ‘Essential’ result above does not apply in Portugal. Other bodies fall in a national category, ‘entidades públicas relevantes’: Group A (in general 250 or more staff, plus all independent administrative bodies) or Group B (75 to 249 staff). Public business entities are grouped by the SME size thresholds instead. The decree places bodies with fewer than 75 staff in neither group. Every public body must self-identify on the CNCS platform, and CNCS decides the category.
- Portugal covers all higher-education institutions, whatever their size (RJC Art. 3(6)). The decree does not say which category applies; CNCS decides it when it qualifies the institution.
Frequently asked questions
Is NIS2 in force in Portugal?
Yes. Decreto-Lei n.º 125/2025 was published on 4 December 2025 and has applied since 3 April 2026 (120 days after publication; some sources give 6 April). CNCS’s implementing regulation (Regulamento n.º 756/2026) has applied since 23 June 2026.
Who is the NIS2 authority in Portugal?
CNCS, the Centro Nacional de Cibersegurança, is the competent authority and single point of contact, and CERT.PT within CNCS is the CSIRT. ANACOM supervises electronic communications and postal services, and GNS supervises trust services.
Do I still need to register with CNCS?
Yes, if you are in scope, including all public bodies. Entities already active had 60 days after the CNCS platform opened (RJC Art. 8(1)). CNCS’s coordinator was reported (ECO, 24 June 2026) as reading this as 60 working days from the launch on 23 June 2026, which ends around 15 September 2026; counted in calendar days it ended about 22 August 2026. Either way the window has closed. Missing it is a ‘serious’ offence (RJC Art. 62(1)(a)), so register as soon as possible. New entities have 30 days from starting activity.
What are the NIS2 fines in Portugal?
For very serious breaches, up to €10 million or 2% of worldwide annual turnover for essential entities and up to €7 million or 1.4% for important entities, whichever is higher, and up to €200,000 where the offender is a natural person. Failing to self-identify is a serious breach, capped at €5 million or 1% (essential) and €3.5 million or 0.7% (important). Until about 3 April 2027 an entity can make a reasoned request to the competent authority not to be fined, on the ground that it has not yet had an internal process to adapt.
Related tools
- NIS2 applicability checker for any EU country
- 50-question NIS2 readiness check
- NIS2 compliance cost calculator
Sources
- Decreto-Lei n.º 125/2025, Diário da República
- Regulamento n.º 756/2026 (CNCS), Diário da República, 2.ª série n.º 118
- ECO, 24 June 2026 (press report)
General information, not legal advice. National rules checked 3 November 2026; the law or its application may have changed since.